Scan tracked files and complete Git history for secrets #17

New issue

Open

opened 2026-11-01 20:11:36 +00:00 by viacheslavshuka · 0 comments

viacheslavshuka commented

2026-11-01 20:11:36 +00:00

Owner

A removed credential can remain exposed in history. Required CI secret scanning must cover both current tracked files and complete Git history.

Scope

Configure pinned Gitleaks CLI scans and a narrow reviewed exception mechanism. Commit hooks scan staged changes with the installed Gitleaks executable.

Acceptance criteria

Pull-request CI scans tracked files and complete repository Git history. The checkout fetches the history that the scan claims to inspect.
A secret present only in an earlier commit still fails the required scan. A shallow or incomplete checkout cannot count as a clean full-history result.
Reports and logs redact detected secret values while preserving enough location and rule information for remediation.
A finding blocks unless a reviewed exception identifies its exact scope, reason, and owner. Verified false positives or confirmed revoked historical credentials can receive narrow exceptions.
A verified live secret cannot receive a waiver. Remediation requires rotation and addressing the exposed credential.
Missing tools, scanner crashes, or incomplete input fail the check. Scanning does not alter repository files or credentials.
Exception tests reject broad wildcard suppression that hides unrelated findings. Temporary acceptance of an actual vulnerability expires within thirty days.

Validation

Use synthetic secret-shaped fixtures in a disposable repository. Cover a staged secret, a current tracked secret, a history-only secret, a redacted report, and an exact exception that leaves another finding blocking.

Dependencies

#13: Enforce complete validation in the shared Forgejo runner flow. The history scan must run as a required CI job.

#5: Configure shared offline commit checks

A removed credential can remain exposed in history. Required CI secret scanning must cover both current tracked files and complete Git history. ## Scope Configure pinned Gitleaks CLI scans and a narrow reviewed exception mechanism. Commit hooks scan staged changes with the installed Gitleaks executable. ## Acceptance criteria - Pull-request CI scans tracked files and complete repository Git history. The checkout fetches the history that the scan claims to inspect. - A secret present only in an earlier commit still fails the required scan. A shallow or incomplete checkout cannot count as a clean full-history result. - Reports and logs redact detected secret values while preserving enough location and rule information for remediation. - A finding blocks unless a reviewed exception identifies its exact scope, reason, and owner. Verified false positives or confirmed revoked historical credentials can receive narrow exceptions. - A verified live secret cannot receive a waiver. Remediation requires rotation and addressing the exposed credential. - Missing tools, scanner crashes, or incomplete input fail the check. Scanning does not alter repository files or credentials. - Exception tests reject broad wildcard suppression that hides unrelated findings. Temporary acceptance of an actual vulnerability expires within thirty days. ## Validation Use synthetic secret-shaped fixtures in a disposable repository. Cover a staged secret, a current tracked secret, a history-only secret, a redacted report, and an exact exception that leaves another finding blocking. ## Dependencies - [#13: Enforce complete validation in the shared Forgejo runner flow](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/13). The history scan must run as a required CI job. ## Related work - [#5: Configure shared offline commit checks](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/5)

viacheslavshuka referenced this issue

2026-11-01 20:11:51 +00:00

Deploy validated main images to development #34

viacheslavshuka added the

kind

area/tooling

size

labels

2026-11-01 20:13:16 +00:00

viacheslavshuka referenced this issue

2026-11-01 20:15:38 +00:00

Enforce complete validation in the shared Forgejo runner flow #13